XHide - Process Faker

Hunt Hypothesis

This detection identifies adversaries employing process faking to masquerade malicious executables as legitimate system processes, thereby evading standard signature-based monitoring. Proactive hunting in Azure Sentinel is essential because these stealthy techniques often bypass initial alerts, requiring behavioral analysis to uncover hidden persistence mechanisms before they escalate into critical incidents.

YARA Rule

rule XHide: MALW
{
	meta:
		description = "XHide - Process Faker"
		author = "Joan Soriano / @w0lfvan"
		date = "2017-12-01"
		version = "1.0"
		MD5 = "c644c04bce21dacdeb1e6c14c081e359"
		SHA256 = "59f5b21ef8a570c02453b5edb0e750a42a1382f6"
	strings:
		$a = "XHide - Process Faker"
		$b = "Fakename: %s PidNum: %d"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the XHide - Process Faker detection rule in an enterprise environment, along with recommended filters or exclusions:

• Antivirus Real-Time Scanning and On-Demand Scans

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black frequently inject code into running processes to perform real-time scanning, memory analysis, or “deep scan” operations. This injection often mimics the behavior of a process faker hiding its presence.
  • Filter/Exclusion: Create an exclusion rule that ignores alerts where the parent process is a known security agent (e.g., C:\Program Files\Microsoft Defender\MsMpEng.exe or C:\ProgramData\CrowdStrike\fsos.exe) and the action involves standard scanning DLLs.

• Scheduled Software Updates via Patch Management Tools

  • Scenario: Automated patch management tools such as Ivanti, ManageEngine Endpoint Central, or WSUS (Windows Server Update Services) often launch temporary worker processes to download, stage, and install updates during maintenance windows. These workers may modify process structures or inject code into the svchost.exe family to apply patches without user interaction, triggering the detection logic.
  • Filter/Exclusion: Exclude alerts occurring between 02:00 and 06:00 UTC on weekdays where the initiating process belongs to known patch management service accounts (e.g., NT SERVICE\IvantiAgent or SYSTEM) and involves update-related executables.

• Enterprise Backup and Data Protection Jobs

  • Scenario: Backup solutions like Veeam Backup & Replication, Commvault, or Acronis Cyber Protect utilize agent processes that hook into the operating system to capture